CVE-2022-50080

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0

Description The issue arises from an integer overflow in the register shm helper() function when calculating the number of pages covered by a user-supplied memory region. This causes a NULL pointer dereference in the internal get user pages fast() function, a helper function of pin user pages fast(). The error occurs when the tee shm register user buf() function fails to validate user space addresses, leading to a kernel NULL pointer dereference.

Recommendations For Linux kernel versions prior to 5.19.0, consider adding an explicit call to access ok() in tee shm register user buf() to catch invalid user space addresses early. As a temporary workaround, restrict the use of the register shm helper() function until a patch is available.